3 ms·

> Why can't I personally test the security of my bank? I don't understand this perspective. What's the difference between tihs and being allowed to try and wal

> Why can't I personally test the security of my bank? I don't understand this perspective. What's the difference between tihs and being allowed to try and walk into all the back rooms of your bank and read everything you can? Or do you think you should be able to do that?

ElevenLathe 2y ago
Should I be prosecuted for walking up to my credit union after closing and trying to open the front door to see if it's really locked?
- robertlagrant 2y ago
  No, just as you should be able to type your bank's URL in your browser even if they've taken the website down.
- taeric 2y ago
  If you proceed into the building? Almost certainly. If you put the doors or windows through a stress test? Again, almost certainly.
  - Buttons840 2y ago
    What if you have money in the bank and the bank has been robbed thousands(!) of times because they forget to lock the windows. Assume nobody is going to do anything to make the bank change their window locking habits, or lack thereof. At this point in the analogy, do you personally believe it is worrisome if an upstanding citizen thinks "I wonder if they forgot to lock the windows again?", and they check to just to see. Is the solution in this scenario to harshly punish the citizen while doing nothing to the bank or their windows? (!): I say thousands because https://haveibeenpwned.com/ https://haveibeenpwned.com/ reports that my email address has appeared in almost 3,000 (three thousand!) data breaches.
    - taeric 2y ago
      This doesn't really help the scenarios, though? In fact, if you know that a place has been the source of a ton of crime, physically going there is a terrible idea. Not sure why similar wouldn't apply for this? I'm... also very curious what expected numbers are there for data breaches? I'm seeing 12. How in the world are you at 3,000?!
      - Buttons840 2y ago
        I haven't given my email address to any websites that are involved with pornography or other disreputable things, nor have I given my email to any website with connections to illegal activities. The number of leaks with my specific email address doesn't really matter. The point here is that there are thousand and thousands of data breaches happening all the time. These all affect real people. These all have wronged people, and these people have no redress. Your gut reaction of "there's a problem, let's criminalize" seems to match the general consensus here in the USA. We'll criminalize and jail endlessly, but it's not working, the problem is getting worse, more data breaches happen all the time, airlines cancel all flights, hospitals cancel medical procedures, all because we can't build secure IT systems. The problem keeps getting worse despite our criminalization. One thing we wont try is expecting competence and accountability (financial liability) from our wealthy and powerful organizations. Nor will we try empowering upstanding security researchers, and meanwhile criminal hackers continue to act with no regard for the law.
        taeric 2y ago
        Where did I give my gut reaction? It would almost certainly be more inline with finding processes to improve things. I'm all for pen tests and similar. Bounty programs are also good ideas. The topic here, though, was whether or not casing out a location would get you in trouble. And, yeah, if you are casing out a place you can get in trouble. Regardless of how much crime has or has not happened there. Indeed, I would stipulate you are less likely to get in trouble if you are checking out a place that has not had crime. And apologies if you thought I was blaming you on the leaks. Not my intent, at all. Genuinely surprised to hear you get 3,000+ hits. Moreso with how few hits I get, relatively.
Buttons840 2y ago
IT systems on the internet are not like physical locations in a peaceful society. The analogy falls apart very quickly. IT systems on the internet are constantly approached by millions of actors, good and bad, and if they are designed correctly then this is no problem and is not a burden on anybody. This is very unlike a comfortable office setting in a peaceful society. You are making an analogy between modern banks and IT systems. Modern banks are almost never breached, while IT systems have major breaches every week. That's not a fair analogy.

ElevenLathe 2y ago

Should I be prosecuted for walking up to my credit union after closing and trying to open the front door to see if it's really locked?

robertlagrant 2y ago
No, just as you should be able to type your bank's URL in your browser even if they've taken the website down.
taeric 2y ago
If you proceed into the building? Almost certainly. If you put the doors or windows through a stress test? Again, almost certainly.
- Buttons840 2y ago
  What if you have money in the bank and the bank has been robbed thousands(!) of times because they forget to lock the windows. Assume nobody is going to do anything to make the bank change their window locking habits, or lack thereof. At this point in the analogy, do you personally believe it is worrisome if an upstanding citizen thinks "I wonder if they forgot to lock the windows again?", and they check to just to see. Is the solution in this scenario to harshly punish the citizen while doing nothing to the bank or their windows? (!): I say thousands because https://haveibeenpwned.com/ https://haveibeenpwned.com/ reports that my email address has appeared in almost 3,000 (three thousand!) data breaches.
  - taeric 2y ago
    This doesn't really help the scenarios, though? In fact, if you know that a place has been the source of a ton of crime, physically going there is a terrible idea. Not sure why similar wouldn't apply for this? I'm... also very curious what expected numbers are there for data breaches? I'm seeing 12. How in the world are you at 3,000?!
    - Buttons840 2y ago
      I haven't given my email address to any websites that are involved with pornography or other disreputable things, nor have I given my email to any website with connections to illegal activities. The number of leaks with my specific email address doesn't really matter. The point here is that there are thousand and thousands of data breaches happening all the time. These all affect real people. These all have wronged people, and these people have no redress. Your gut reaction of "there's a problem, let's criminalize" seems to match the general consensus here in the USA. We'll criminalize and jail endlessly, but it's not working, the problem is getting worse, more data breaches happen all the time, airlines cancel all flights, hospitals cancel medical procedures, all because we can't build secure IT systems. The problem keeps getting worse despite our criminalization. One thing we wont try is expecting competence and accountability (financial liability) from our wealthy and powerful organizations. Nor will we try empowering upstanding security researchers, and meanwhile criminal hackers continue to act with no regard for the law.
      - taeric 2y ago
        Where did I give my gut reaction? It would almost certainly be more inline with finding processes to improve things. I'm all for pen tests and similar. Bounty programs are also good ideas. The topic here, though, was whether or not casing out a location would get you in trouble. And, yeah, if you are casing out a place you can get in trouble. Regardless of how much crime has or has not happened there. Indeed, I would stipulate you are less likely to get in trouble if you are checking out a place that has not had crime. And apologies if you thought I was blaming you on the leaks. Not my intent, at all. Genuinely surprised to hear you get 3,000+ hits. Moreso with how few hits I get, relatively.

Buttons840 2y ago

IT systems on the internet are not like physical locations in a peaceful society. The analogy falls apart very quickly. IT systems on the internet are constantly approached by millions of actors, good and bad, and if they are designed correctly then this is no problem and is not a burden on anybody. This is very unlike a comfortable office setting in a peaceful society. You are making an analogy between modern banks and IT systems. Modern banks are almost never breached, while IT systems have major breaches every week. That's not a fair analogy.